ONS & NHS Digital COVID-19 Public Health Research Database: Privacy Policy

This privacy policy relates to the creation of the COVID-19 Public Health Research Database by the Office for National Statistics (ONS) and NHS Digital.

NHS Digital is the information and technology partner to the NHS in England. We are responsible for operating national IT systems and for securely collecting, analysing, publishing and sharing information to improve health and social care in England. Find out more about NHS Digital.

The Office for National Statistics is the UK’s largest independent producer of official statistics and the recognised national statistical institute of the UK. It is responsible for collecting and publishing statistics related to the economy, population and society at national, regional and local levels. It plays a leading role in national and international good practice in the production of official statistics.  Find out more about the Office for National Statistics.

The COVID-19 Public Health Research Database will enable approved researchers to analyse whether particular illnesses, conditions or societal circumstances mean types of people are less or more likely to be affected by COVID-19, enabling the UK to tailor its approach to those groups to save lives and reduce the impact and spread of the virus.  The information that researchers see about people in the database will be anonymous. This means that they will not be able to identify any individual the information is about. This database is referred to in this privacy policy as the 'Research Database'.

In this privacy policy, 'we' or 'us' means NHS Digital and 'ONS' means the Office for National Statistics. 'You' or 'your' means you, a member of the public whose details are used (but in an anonymous form) in the Research Database.

Learn more about coronavirus (COVID-19).

NHS Digital and ONS have been asked by Health Data Research UK, the Department for Health and Social Care and the Scientific Advisory Group on Emergencies (SAGE) to create the Research Database to support the National Core Studies programme being led by Health Data Research UK. This programme uses health data and research to inform the long-term response to COVID-19. Making the Research Database available to researchers is supported by the Scientific Advisory Group on Emergencies (SAGE), the New and Emerging Respiratory Threats Advisory Group (NERVTAG), and other Government pandemic advisory groups who will make use of the research enabled by the database.

The Research Database is created from certain health data which NHS Digital already shares with the ONS for its own use for statistical purposes. This is currently only Hospital Episode Statistics but more health data will be added to the Research Database shortly. We will update this privacy notice here when more health data is added.

This health data, which contains personal data, is linked by ONS to ONS’s Census data and Mortality data. All identifying information about individuals in the data is removed by ONS to create the Research Database.

ONS grants access to the Research Database to certain researchers only, called Approved Researchers, who agree to strict conditions for accessing the database. Researchers can also only access the Research Database to carry out statistical research for the purposes of the monitoring and control of COVID-19. ONS also ensures that the data in the Research Database is anonymous when it is accessed by Approved Researchers.

More details about how ONS provide access to data for research can be found here. A published list of researchers granted access to ONS data can be found here.

NHS Digital is a controller under the UK General Data Protection Regulation (GDPR) of the health data we share with ONS. We share health data with ONS for statistical purposes under Section 45A and 45C of the Statistics and Registration Service Act 2007 (SRSA).

Under GDPR, we share health data with ONS under:

• Article 6(1)(e) – as processing is necessary for the performance of a task carried out in the public interest, under the SRSA.
• Article 9(2)(g) – as processing is necessary for reasons of substantial public interest. We consider it is substantially in the public interest to permit ONS to process and share health data for its statistical functions and to promote and enable statistical research for COVID-19 purposes through processing the health data to create the Research Database and make anonymous data available to Approved Researchers. We also rely on Paragraph 6 of Part 2 of Schedule 1 of the Data Protection Act 2018 (DPA18) as processing is necessary for statutory and government etc purposes.
• Article 9(2)(j) – as processing is necessary for statistical and research purposes under the SRSA. We also rely on Paragraph 4 of Part 1 of Schedule 1 of the DPA18 as processing is necessary for statistical and research etc purposes. 

ONS is a controller under GDPR of the health data we share with it. It is also a controller for the other personal data it processes for statistical purposes and is the controller for the Research Database.

ONS processes health data we share with it for statistical purposes under Section 45A and Section 45C of the SRSA. It creates the Research Database using its powers under Section 23 and 38 of the SRSA. It grants access to the Research Database by Approved Researchers under Section 39(4)(i) of the SRSA.  NHS Digital must however consent to this access under Section 45A and Section 45E of the SRSA. NHS Digital is a joint controller with ONS in relation to the giving of this consent.

Under GDPR, ONS processes the health data and other personal data to create the Research Database and to provide Approved Researchers with access to it under:

• Article 6(1)(e) - public task, under the SRSA, and
• Article 9(2)(j) - processing for statistical and research purposes, together with Paragraph 4 of Part 1 of Schedule 1 of the DPA18 - research etc.

National Data Opt Outs

The National Data Opt Out does not apply to the health data we share with ONS for their own statistical purposes, as this purpose is exempt under the National Data Opt Out Policy.

ONS however remove identifiable information from the health data we have shared with them when they create the Research Database, and they only ever share anonymous data with Approved Researchers. The National Data Opt Out does not apply to anonymous information which is used for research purposes, as it can no longer identify you. 

The following types of personal information are processed by ONS in the Research Database:

• The ONS Census 2011 data within the database includes age, sex, occupation, ethnicity, tenure, socio-economic class, religion and marital status.
• The ONS Mortality data within the database includes date and cause of death.
• The health data we have shared with ONS which is included within the database are flags based variables which are linked to the 2011 Census data and Mortality data. Each flag indicates whether there is evidence (yes or no) of a particular illness or condition for a person based on hospital admissions since 2017, for example, cardiovascular disease.

ONS ensures that the data in the Research Database is anonymous when it is accessed by Approved Researchers.

ONS

For more information about how ONS uses personal information, including contact details for their data protection officer please see their Privacy Information

NHS Digital

For more information about the health and care information NHS Digital collects, analyses, publishes and shares and what choices and rights you have, see how we look after your health and care information, our general transparency notice and our Coronavirus (COVID-19) response transparency notice

The terms of our privacy policy may change from time to time. Any updates to the privacy policy will be published on NHS Digital's website.

None